A Linux kernel bug in the BPF subsystem allows a preemptible BPF program to trigger an out-of-bounds write while copying a per-CPU call‑chain buffer. The bug stems from the timer‑independent reuse of a per-CPU buffer between the call to __bpf_get_stack and the subsequent memcpy. If an attacker can run a BPF program that is preemptible, the kernel may allow the buffer to be overwritten, causing trace->nr to grow beyond the caller’s buffer size. The overflow can corrupt memory and potentially lead to privilege escalation or denial of service, depending on the context in which the write occurs. The weakness is a classic out‑of-bounds write (CWE‑787).

The vulnerability impacts all Linux kernel builds that contain the unpatched BPF implementation. The affected vendor is Linux, product Linux Kernel. No specific version information is supplied; any kernel version prior to the fix that includes the referenced commit is affected.

The CVSS score of 6.3 indicates a moderate severity. EPSS score of <1%, and the vulnerability is not listed in CISA KEV, implying no publicly documented exploits. Exploitation requires the ability to load a BPFemptible context such as a raw tracepoint or BPF program run under migrate_disable(). The attacker therefore needs local kernel or privileged access to inject BPF code, making remote exploitation unlikely under ordinary circumstances. Nonetheless, compromised nodes could experience memory corruption or a crash.